Hot answers tagged python
3
If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want.
Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...
2
As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...
2
You might want to take a look at the Canari Framework (https://www.canariproject.com/4-3-transform-development-quick-start/). It's an awesomely simple transform development framework that let's you do some pretty rad things ;).
UPDATE 1:
Canari now has some additional support for complex field types. So far we've added datetime, timespan, color, and date. ...
2
How can I implement secure connection between client and my python server? I guess I could use SSH or SSL, but which one will be better suited for the job? And If I choose SSH then wouldn't it interfere with SSH login service I use to manage my (whole) server?
If it is only you that will be connecting to the server, I would secure the whole process ...
2
As you ouline, due to the limitaiton of /etc/shadow access, at some level, your application will either have to access that file or access some other module/service which has access to that file. There is no avoiding it if you want a solution which uses locally managed user credentials (unless you totally roll your own, which I strongly recommend avoiding).
...
1
Another possibility would be to run (part of) your program as root inside a virtual environment. Linux containers (lxc) make this lightweight.
Consider that anything your application can do, an attacker can do if your application is compromised. Therefore you should not allow (the bulk of) your application to expose valid user names or make password checks ...
Only top voted, non community-wiki answers of a minimum length are eligible
